The present invention relates to a method for validating the value of a parameter. The method applies to all fields where, particularly for security or productivity reasons, it is vital to know a reliable value of a parameter, physical quantity or the like. In this case, use is made of a plurality of sensors and/or redundant calculating means for the measurement or calculation of the values of said parameter. One value of this parameter is validated as a function of these values. The invention relates to such a validation method.
The need to be sure that a physical value is correct has greatly increased, particularly with the industrial use of nuclear energy. Certain incidents have revealed the consequences of defective instrumentation leading either to untimely shutdowns, which are prejudicial to productivity, or to incorrect analyses on the part of operators, which can lead to dangerous decisions.
To obviate this, in per se known manner, use is made of a plurality of sensors which consequently produce a redundancy so that, by comparison, the value of the parameter can be more reliably evaluated, even in the presence of a defective sensor. The sensors can optionally be replaced by models which, as a function of indirect measurements, deduce one value of the parameter by calculation. The replacement of the sensors by models is of a standard nature in the aerospace industry, in order to reduce weight.
The validation method must in particular make it possible to determine failures of a sensor or model, such as a bias, drift, signal saturation, noise added to the measurement, or aberrant values.
Methods are known which make it possible to detect one or more of these shortcomings. However, none of the known methods make it possible to detect all these shortcomings. Moreover, these methods are generally able to detect a difference between the measuring channels, but are not always able to identify which particular channel or channels is defective.
A first or so-called signs test method is known, which makes it possible to validate the value of a parameter measured by two paired sensors. The method consists of studying the difference d.sub.i =x.sub.i -y.sub.i, in which x.sub.i and y.sub.i are sampled values of signals supplied by the two sensors at time i, in which i.gtoreq.1. The number k of positive differences d.sub.i follows a binomial law defined by the size n of each sample and by the probability p=0.5.
The principle of the validation consists of storing the signs of n last differences between the two series of measurements. An alarm is triggered as soon as the number of differences of the same sign exceeds n/2+n.sub.0,
in which n.sub.o is a threshold dependent on a compromise between the desired sensitivity and the false alarm probability.
This method suffers from the disadvantage that in principle, it is not sensitive to the amplitude of the difference. As from the time when one measurement is greater than or less than the other for an adequately long time, even with a very limited variation, detection is inevitable without any possibility of regulating the sensitivity. Thus, this method requires sensors having performance levels which are not realistic in an industrial situation (strict calibration, absolute linearity over the entire measurement scale, identical response time, etc).
This method is not able to detect noise, if the latter is more or less centered relative to the valid signal, or an aberrant value, but is able to detect a bias, even if it is very small. A signal saturation or drift are also correctly detected. This method is not very suitable for the validation of a measurement. Thus, it sometimes validates incoherent measurements (noise) and sometimes triggers false alarms (limited bias).
A second or so-called pairing method is known, which also consists of studying the difference d.sub.i defined hereinbefore. If the two sensors supply coherent signals, the difference or variable d.sub.i is a normal law of mean 0 and standard deviations .sigma..sub.d. The variable m.sub.i equal to: ##EQU1## then follows a normal law of mean 0 and standard deviation .sigma..sub.d /.sqroot.N. Thus, the variable t equal to m.sub.d .multidot..sqroot.N/.sigma..sub.d follows a Student-Fischer law with n-1 degrees of freedom.
A fault is detected if the observed value of the variable t exceeds a threshold r determined as a function of the Student-Fischer law table.
This test does not react well to certain defects, such as noise, rapid drifts and a bias in the presence of aberrant values. Thus, this method only makes it possible to detect a shortcoming representing a displacement of the signals.
A third method is known, in which there are n redundant sensors, in which n exceeds 3 and which gives, at each sampling instant, n observations X.sub.1, Xhd 2 . . . X.sub.n. At each sampling time, one defines: ##EQU2##
In normal operation, the measurements are normally distributed about the true value m. When a measurement moves away from the normal distribution, x and x move away from m, but more sensitively for x than for x.
This property is utilized for the discordance or difference detection. At each sampling time, the test relates to the ratio ##EQU3## If Q exceeds a certain predetermined threshold, tne most offcentered measurement is eliminated and a further validation takes place with the n-1 remaining measurements.
This method requires an order of redundancy equal to or greater than 3, because, if n=2, Q is constantly zero. In the case where the order of redundancy is equal to 3, when Q exceeds the threshold, the most offcentered measurement is eliminated and it is no longer possible to carry out a new validation on the basis of the two remaining measurements. Whatever the threshold value, this method leads to incorrect detections in normal situations, or to non-detections in abnormal situations (large drifts or bias).
A fourth method is known, which is called the probability ratio sequential test. This method utilizes statistical properties of time samples of the signal, which characterize the deviation x.sub.3 (t) between two measurements x.sub.1 (t) and x.sub.2 (t) supplied by two redundant sensors.
The test deals with the same quantity as the pairing method test. The interest of this method is based on the fact that it takes into account the notions of the probability of false alarms and non-detections. The methods making it possible to evaluate these probabilities are based on a knowledge of distribution laws which, often, is not very effective in an industrial situation, the choice of the thresholds necessary for the validation method generally empirically gaining in refinement when used industrially. This method suffers from the same shortcomings as the pairing method and only makes it possible to reveal a displacement between the two signals.
A fifth method is known, which is used when two direct measurements are available and when a third measurement can be obtained by correlation. The detection of a difference between the two direct channels is obtained by a comparison of the variation signal at fixed thresholds. In the case of a difference, use is made of the third measuring channel for locating the defective channel. The validated measurement is that which is closest to said third measurement obtained by correlation. In the case of non-discordance, the validated measurement is the mean value of the two signals from two sensors.
This method is much more elaborate than the preceding methods, because it does not use the detection theory. The test is punctiform and relates to the variation between the signals at a given time. This method is not particularly satisfactory, because it does not take account of the history of the signals. However, when a fault appears, the response is immediate.
Finally, there is a sixth method, which was developed by Electricite de France. It relates to a complex theory and is applicable for any redundancy order, equal to or greater than 2.
This so-called parity space method consists of defining and displaying a vector, which reflects the discordance between the different channels. The standard of this parity vector makes it possible to detect a discordance or difference and its direction makes it possible to locate the defective channel.
The method consists of comparing the measurements from the redundant sensors in pairs. Two measurements are coherent when their tolerance range, defined by the precision characteristics, the hysteresis and the linearity of the sensor intersect, so that it is possible a priori to predict that the true value (unknown) of the measured quantity is at this intersection.
The detection method is punctiform and relates to the present time, without taking account of the past and consequently loses much information. This approach is not very suitable for an optimum detection of all types of fault. For example, in the case of a drift of one among these sensors, this method is unable to rapidly determine which is the defective sensor. Moreover, when a multiple fault appears, the method is unable to produce information. In general terms, the parity space method does not make it possible to establish the type of fault and in fact merely detects a discordance between the redundant channels.
The above description has shown the shortcomings of the known validation methods. It has shown that it is easy to provide a validation method, which reacts well to a particular type of fault, but it is difficult to provide such a method which behaves well in the case of the five most commonly encountered faults. With the known methods, there are often cases of nondetection of faults, or of incorrect detection leading to a false alarm.
The validation methods using statistical characteristics of the difference between two measurement channels would not appear to be suitable in connection with the problem of validating measurements. Thus, these methods assume a gaussian distribution of the differences. However, under dynamic conditions or when a fault appears, this hypothesis is null and void. It is then necessary to process a large sample in order to carry out a detection under conditions of adequate reliability, which is to the detriment of the response time.
Moreover, a punctiform validation method is unable, as soon as the difference between two channels exceeds a certain threshold, to produce a reliable information. Such a method deals with the information of the present time. The past is not taken into account, but in certain cases the knowledge thereof can help in taking a decision..